@boxyhq/saml-jackson 1.3.5 → 1.3.7

package/dist/controller/api.d.ts

@@ -31,10 +31,6 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *            "description": "SP for hoppscotch.io",
      *            "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
      *            "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *            "certs": {
-     *              "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *              "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *            }
      *          }
      *    validationErrorsPost:
      *      description: Please provide rawMetadata or encodedRawMetadata | Please provide a defaultRedirectUrl | Please provide redirectUrl | redirectUrl is invalid | Exceeded maximum number of allowed redirect urls | defaultRedirectUrl is invalid | Please provide tenant | Please provide product | Please provide a friendly name | Description should not exceed 100 characters | Strategy: xxxx not supported | Please provide the clientId from OpenID Provider | Please provide the clientSecret from OpenID Provider | Please provide the discoveryUrl for the OpenID Provider
@@ -60,6 +56,11 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *     description: Raw XML metadata
      *     in: formData
      *     type: string
+     *   metadataUrlParamPost:
+     *     name: metadataUrl
+     *     description: URL containing raw XML metadata
+     *     in: formData
+     *     type: string
      *   defaultRedirectUrlParamPost:
      *     name: defaultRedirectUrl
      *     description: The redirect URL to use in the IdP login flow
@@ -115,6 +116,7 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *      - $ref: '#/parameters/descriptionParamPost'
      *      - $ref: '#/parameters/encodedRawMetadataParamPost'
      *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/metadataUrlParamPost'
      *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
      *      - $ref: '#/parameters/redirectUrlParamPost'
      *      - $ref: '#/parameters/tenantParamPost'
@@ -145,6 +147,7 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *      - $ref: '#/parameters/descriptionParamPost'
      *      - $ref: '#/parameters/encodedRawMetadataParamPost'
      *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/metadataUrlParamPost'
      *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
      *      - $ref: '#/parameters/redirectUrlParamPost'
      *      - $ref: '#/parameters/tenantParamPost'
@@ -203,6 +206,11 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *     description: Raw XML metadata
      *     in: formData
      *     type: string
+     *   metadataUrlParamPatch:
+     *     name: metadataUrl
+     *     description: URL containing raw XML metadata
+     *     in: formData
+     *     type: string
      *   oidcDiscoveryUrlPatch:
      *     name: oidcDiscoveryUrl
      *     description: well-known URL where the OpenID Provider configuration is exposed
@@ -256,6 +264,7 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *       - $ref: '#/parameters/descriptionParamPatch'
      *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
      *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/metadataUrlParamPatch'
      *       - $ref: '#/parameters/defaultRedirectUrlParamPatch'
      *       - $ref: '#/parameters/redirectUrlParamPatch'
      *       - $ref: '#/parameters/tenantParamPatch'
@@ -282,6 +291,7 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *       - $ref: '#/parameters/descriptionParamPatch'
      *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
      *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/metadataUrlParamPatch'
      *       - $ref: '#/parameters/oidcDiscoveryUrlPatch'
      *       - $ref: '#/parameters/oidcClientIdPatch'
      *       - $ref: '#/parameters/oidcClientSecretPatch'
@@ -362,9 +372,6 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *        idpMetadata:
      *          type: object
      *          description: SAML IdP metadata
-     *        certs:
-     *          type: object
-     *          description: Certs generated for SAML connection
      *        oidcProvider:
      *          type: object
      *          description: OIDC IdP metadata
@@ -435,10 +442,6 @@ export declare class ConnectionAPIController implements IConnectionAPIController
      *                "description": "SP for hoppscotch.io",
      *                "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
      *                "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *                "certs": {
-     *                  "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *                  "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *                }
      *            }
      *      '400':
      *        $ref: '#/responses/400Get'

package/dist/controller/api.js

@@ -72,10 +72,6 @@ class ConnectionAPIController {
      *            "description": "SP for hoppscotch.io",
      *            "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
      *            "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *            "certs": {
-     *              "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *              "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *            }
      *          }
      *    validationErrorsPost:
      *      description: Please provide rawMetadata or encodedRawMetadata | Please provide a defaultRedirectUrl | Please provide redirectUrl | redirectUrl is invalid | Exceeded maximum number of allowed redirect urls | defaultRedirectUrl is invalid | Please provide tenant | Please provide product | Please provide a friendly name | Description should not exceed 100 characters | Strategy: xxxx not supported | Please provide the clientId from OpenID Provider | Please provide the clientSecret from OpenID Provider | Please provide the discoveryUrl for the OpenID Provider
@@ -101,6 +97,11 @@ class ConnectionAPIController {
      *     description: Raw XML metadata
      *     in: formData
      *     type: string
+     *   metadataUrlParamPost:
+     *     name: metadataUrl
+     *     description: URL containing raw XML metadata
+     *     in: formData
+     *     type: string
      *   defaultRedirectUrlParamPost:
      *     name: defaultRedirectUrl
      *     description: The redirect URL to use in the IdP login flow
@@ -156,6 +157,7 @@ class ConnectionAPIController {
      *      - $ref: '#/parameters/descriptionParamPost'
      *      - $ref: '#/parameters/encodedRawMetadataParamPost'
      *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/metadataUrlParamPost'
      *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
      *      - $ref: '#/parameters/redirectUrlParamPost'
      *      - $ref: '#/parameters/tenantParamPost'
@@ -186,6 +188,7 @@ class ConnectionAPIController {
      *      - $ref: '#/parameters/descriptionParamPost'
      *      - $ref: '#/parameters/encodedRawMetadataParamPost'
      *      - $ref: '#/parameters/rawMetadataParamPost'
+     *      - $ref: '#/parameters/metadataUrlParamPost'
      *      - $ref: '#/parameters/defaultRedirectUrlParamPost'
      *      - $ref: '#/parameters/redirectUrlParamPost'
      *      - $ref: '#/parameters/tenantParamPost'
@@ -262,6 +265,11 @@ class ConnectionAPIController {
      *     description: Raw XML metadata
      *     in: formData
      *     type: string
+     *   metadataUrlParamPatch:
+     *     name: metadataUrl
+     *     description: URL containing raw XML metadata
+     *     in: formData
+     *     type: string
      *   oidcDiscoveryUrlPatch:
      *     name: oidcDiscoveryUrl
      *     description: well-known URL where the OpenID Provider configuration is exposed
@@ -315,6 +323,7 @@ class ConnectionAPIController {
      *       - $ref: '#/parameters/descriptionParamPatch'
      *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
      *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/metadataUrlParamPatch'
      *       - $ref: '#/parameters/defaultRedirectUrlParamPatch'
      *       - $ref: '#/parameters/redirectUrlParamPatch'
      *       - $ref: '#/parameters/tenantParamPatch'
@@ -341,6 +350,7 @@ class ConnectionAPIController {
      *       - $ref: '#/parameters/descriptionParamPatch'
      *       - $ref: '#/parameters/encodedRawMetadataParamPatch'
      *       - $ref: '#/parameters/rawMetadataParamPatch'
+     *       - $ref: '#/parameters/metadataUrlParamPatch'
      *       - $ref: '#/parameters/oidcDiscoveryUrlPatch'
      *       - $ref: '#/parameters/oidcClientIdPatch'
      *       - $ref: '#/parameters/oidcClientSecretPatch'
@@ -431,9 +441,6 @@ class ConnectionAPIController {
      *        idpMetadata:
      *          type: object
      *          description: SAML IdP metadata
-     *        certs:
-     *          type: object
-     *          description: Certs generated for SAML connection
      *        oidcProvider:
      *          type: object
      *          description: OIDC IdP metadata
@@ -549,10 +556,6 @@ class ConnectionAPIController {
      *                "description": "SP for hoppscotch.io",
      *                "clientID": "Xq8AJt3yYAxmXizsCWmUBDRiVP1iTC8Y/otnvFIMitk",
      *                "clientSecret": "00e3e11a3426f97d8000000738300009130cd45419c5943",
-     *                "certs": {
-     *                  "publicKey": "-----BEGIN CERTIFICATE-----.......-----END CERTIFICATE-----",
-     *                  "privateKey": "-----BEGIN PRIVATE KEY-----......-----END PRIVATE KEY-----"
-     *                }
      *            }
      *      '400':
      *        $ref: '#/responses/400Get'

package/dist/controller/connection/saml.js

@@ -50,11 +50,24 @@ const crypto_1 = __importDefault(require("crypto"));
 const dbutils = __importStar(require("../../db/utils"));
 const utils_1 = require("../utils");
 const saml20_1 = __importDefault(require("@boxyhq/saml20"));
-const x509_1 = __importDefault(require("../../saml/x509"));
 const error_1 = require("../error");
+const axios_1 = __importDefault(require("axios"));
+function fetchMetadata(resource) {
+    return __awaiter(this, void 0, void 0, function* () {
+        const response = yield (0, axios_1.default)(resource, {
+            maxContentLength: 1000000,
+            maxBodyLength: 1000000,
+            timeout: 8000,
+        }).catch((error) => {
+            var _a;
+            throw new error_1.JacksonError("Couldn't fetch XML data", ((_a = error.response) === null || _a === void 0 ? void 0 : _a.status) || 400);
+        });
+        return response.data;
+    });
+}
 const saml = {
     create: (body, connectionStore) => __awaiter(void 0, void 0, void 0, function* () {
-        const { encodedRawMetadata, rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product, name, description, } = body;
+        const { encodedRawMetadata, rawMetadata, defaultRedirectUrl, redirectUrl, tenant, product, name, description, metadataUrl, } = body;
         const forceAuthn = body.forceAuthn == 'true' || body.forceAuthn == true;
         let connectionClientSecret;
         (0, utils_1.validateSSOConnection)(body, 'saml');
@@ -70,12 +83,14 @@ const saml = {
             clientID: '',
             clientSecret: '',
             forceAuthn,
+            metadataUrl,
         };
-        let metaData = rawMetadata;
+        let metadata = rawMetadata;
         if (encodedRawMetadata) {
-            metaData = Buffer.from(encodedRawMetadata, 'base64').toString();
+            metadata = Buffer.from(encodedRawMetadata, 'base64').toString();
         }
-        const idpMetadata = (yield saml20_1.default.parseMetadata(metaData, {}));
+        metadata = metadataUrl ? yield fetchMetadata(metadataUrl) : metadata;
+        const idpMetadata = (yield saml20_1.default.parseMetadata(metadata, {}));
         if (!idpMetadata.entityID) {
             throw new error_1.JacksonError("Couldn't parse EntityID from SAML metadata", 400);
         }
@@ -86,12 +101,7 @@ const saml = {
         }
         idpMetadata.provider = providerName ? providerName : 'Unknown';
         record.clientID = dbutils.keyDigest(dbutils.keyFromParts(tenant, product, idpMetadata.entityID));
-        const certs = yield x509_1.default.generate();
-        if (!certs) {
-            throw new error_1.JacksonError('Error generating x509 certs');
-        }
         record.idpMetadata = idpMetadata;
-        record.certs = certs;
         const exists = yield connectionStore.get(record.clientID);
         if (exists) {
             connectionClientSecret = exists.clientSecret;
@@ -113,7 +123,7 @@ const saml = {
     update: (body, connectionStore, connectionsGetter) => __awaiter(void 0, void 0, void 0, function* () {
         const { encodedRawMetadata, // could be empty
         rawMetadata, // could be empty
-        defaultRedirectUrl, redirectUrl, name, description, forceAuthn = false } = body, clientInfo = __rest(body, ["encodedRawMetadata", "rawMetadata", "defaultRedirectUrl", "redirectUrl", "name", "description", "forceAuthn"]);
+        defaultRedirectUrl, redirectUrl, name, description, forceAuthn = false, metadataUrl } = body, clientInfo = __rest(body, ["encodedRawMetadata", "rawMetadata", "defaultRedirectUrl", "redirectUrl", "name", "description", "forceAuthn", "metadataUrl"]);
         if (!(clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientID)) {
             throw new error_1.JacksonError('Please provide clientID', 400);
         }
@@ -135,13 +145,14 @@ const saml = {
         if (_savedConnection.clientSecret !== (clientInfo === null || clientInfo === void 0 ? void 0 : clientInfo.clientSecret)) {
             throw new error_1.JacksonError('clientSecret mismatch', 400);
         }
-        let metaData = rawMetadata;
+        let metadata = rawMetadata;
         if (encodedRawMetadata) {
-            metaData = Buffer.from(encodedRawMetadata, 'base64').toString();
+            metadata = Buffer.from(encodedRawMetadata, 'base64').toString();
         }
+        metadata = metadataUrl ? yield fetchMetadata(metadataUrl) : metadata;
         let newMetadata;
-        if (metaData) {
-            newMetadata = yield saml20_1.default.parseMetadata(metaData, {});
+        if (metadata) {
+            newMetadata = yield saml20_1.default.parseMetadata(metadata, {});
             if (!newMetadata.entityID) {
                 throw new error_1.JacksonError("Couldn't parse EntityID from SAML metadata", 400);
             }

package/dist/controller/logout.js

@@ -46,6 +46,7 @@ const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 const error_1 = require("./error");
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
+const x509_1 = require("../saml/x509");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const relayStatePrefix = 'boxyhq_jackson_';
 const logoutXPath = "/*[local-name(.)='LogoutRequest']";
@@ -72,7 +73,8 @@ class LogoutController {
             if (!samlConnection) {
                 throw new error_1.JacksonError('SAML connection not found.', 403);
             }
-            const { idpMetadata: { slo, provider }, certs: { privateKey, publicKey }, } = samlConnection;
+            const { idpMetadata: { slo, provider }, } = samlConnection;
+            const { privateKey, publicKey } = yield (0, x509_1.getDefaultCertificate)();
             if ('redirectUrl' in slo === false && 'postUrl' in slo === false) {
                 throw new error_1.JacksonError(`${provider} doesn't support SLO or disabled by IdP.`, 400);
             }

package/dist/controller/oauth.js

@@ -50,7 +50,7 @@ const allowed = __importStar(require("./oauth/allowed"));
 const codeVerifier = __importStar(require("./oauth/code-verifier"));
 const redirect = __importStar(require("./oauth/redirect"));
 const utils_1 = require("./utils");
-const x509_1 = __importDefault(require("../saml/x509"));
+const x509_1 = require("../saml/x509");
 const deflateRawAsync = (0, util_1.promisify)(zlib_1.deflateRaw);
 const validateSAMLResponse = (rawResponse, validateOpts) => __awaiter(void 0, void 0, void 0, function* () {
     const profile = yield saml20_1.default.validate(rawResponse, validateOpts);
@@ -61,6 +61,8 @@ const validateSAMLResponse = (rawResponse, validateOpts) => __awaiter(void 0, vo
         if (!profile.claims.id && profile.claims.email) {
             profile.claims.id = crypto_1.default.createHash('sha256').update(profile.claims.email).digest('hex');
         }
+        // we'll send a ripemd160 hash of the id, this can be used in the case of email missing it can be used as the local part
+        profile.claims.idHash = dbutils.keyDigest(profile.claims.id);
     }
     return profile;
 });
@@ -312,27 +314,8 @@ class OAuthController {
                         }),
                     };
                 }
+                const cert = yield (0, x509_1.getDefaultCertificate)();
                 try {
-                    const { validTo } = new crypto_1.default.X509Certificate(connection.certs.publicKey);
-                    const isValidExpiry = validTo != 'Bad time value' && new Date(validTo) > new Date();
-                    if (!isValidExpiry) {
-                        const certs = yield x509_1.default.generate();
-                        connection.certs = certs;
-                        if (certs) {
-                            yield this.connectionStore.put(connection.clientID, connection, {
-                                // secondary index on entityID
-                                name: utils_1.IndexNames.EntityID,
-                                value: connection.idpMetadata.entityID,
-                            }, {
-                                // secondary index on tenant + product
-                                name: utils_1.IndexNames.TenantProduct,
-                                value: dbutils.keyFromParts(connection.tenant, connection.product),
-                            });
-                        }
-                        else {
-                            throw new Error('Error generating x509 certs');
-                        }
-                    }
                     // We will get undefined or Space delimited, case sensitive list of ASCII string values in prompt
                     // If login is one of the value in prompt we want to enable forceAuthn
                     // Else use the saml connection forceAuthn value
@@ -341,8 +324,8 @@ class OAuthController {
                         ssoUrl,
                         entityID: this.opts.samlAudience,
                         callbackUrl: this.opts.externalUrl + this.opts.samlPath,
-                        signingKey: connection.certs.privateKey,
-                        publicKey: connection.certs.publicKey,
+                        signingKey: cert.privateKey,
+                        publicKey: cert.publicKey,
                         forceAuthn: promptOptions.length > 0 ? true : !!connection.forceAuthn,
                     });
                 }
@@ -544,10 +527,11 @@ class OAuthController {
             if (!samlConnection) {
                 throw new error_1.JacksonError('SAML connection not found.', 403);
             }
+            const { privateKey } = yield (0, x509_1.getDefaultCertificate)();
             const validateOpts = {
                 thumbprint: samlConnection.idpMetadata.thumbprint,
                 audience: this.opts.samlAudience,
-                privateKey: samlConnection.certs.privateKey,
+                privateKey,
             };
             if (session &&
                 session.redirect_uri &&
@@ -622,6 +606,7 @@ class OAuthController {
             const idTokenClaims = tokenSet.claims();
             const userinfo = yield oidcClient.userinfo(tokenSet);
             profile.claims.id = idTokenClaims.sub;
+            profile.claims.idHash = dbutils.keyDigest(idTokenClaims.sub);
             profile.claims.email = (_a = idTokenClaims.email) !== null && _a !== void 0 ? _a : userinfo.email;
             profile.claims.firstName = (_b = idTokenClaims.given_name) !== null && _b !== void 0 ? _b : userinfo.given_name;
             profile.claims.lastName = (_c = idTokenClaims.family_name) !== null && _c !== void 0 ? _c : userinfo.family_name;

package/dist/controller/sp-config.d.ts

@@ -1,21 +1,22 @@
 import type { JacksonOption } from '../typings';
 export declare class SPSAMLConfig {
     private opts;
-    constructor(opts: JacksonOption);
+    private getDefaultCertificate;
+    constructor(opts: JacksonOption, getDefaultCertificate: any);
     private get acsUrl();
     private get entityId();
     private get responseSigned();
     private get assertionSignature();
     private get signatureAlgorithm();
-    private get assertionEncryption();
-    get(): {
+    get(): Promise<{
         acsUrl: string;
         entityId: string;
         response: string;
         assertionSignature: string;
         signatureAlgorithm: string;
-        assertionEncryption: string;
-    };
+        publicKey: string;
+        publicKeyString: string;
+    }>;
     toMarkdown(): string;
     toHTML(): string;
 }

package/dist/controller/sp-config.js

@@ -1,11 +1,25 @@
 "use strict";
+var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, generator) {
+    function adopt(value) { return value instanceof P ? value : new P(function (resolve) { resolve(value); }); }
+    return new (P || (P = Promise))(function (resolve, reject) {
+        function fulfilled(value) { try { step(generator.next(value)); } catch (e) { reject(e); } }
+        function rejected(value) { try { step(generator["throw"](value)); } catch (e) { reject(e); } }
+        function step(result) { result.done ? resolve(result.value) : adopt(result.value).then(fulfilled, rejected); }
+        step((generator = generator.apply(thisArg, _arguments || [])).next());
+    });
+};
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.SPSAMLConfig = void 0;
 const marked_1 = require("marked");
+const saml20_1 = __importDefault(require("@boxyhq/saml20"));
 // Service Provider SAML Configuration
 class SPSAMLConfig {
-    constructor(opts) {
+    constructor(opts, getDefaultCertificate) {
         this.opts = opts;
+        this.getDefaultCertificate = getDefaultCertificate;
     }
     get acsUrl() {
         return `${this.opts.externalUrl}${this.opts.samlPath}`;
@@ -22,18 +36,19 @@ class SPSAMLConfig {
     get signatureAlgorithm() {
         return 'RSA-SHA256';
     }
-    get assertionEncryption() {
-        return 'Unencrypted';
-    }
     get() {
-        return {
-            acsUrl: this.acsUrl,
-            entityId: this.entityId,
-            response: this.responseSigned,
-            assertionSignature: this.assertionSignature,
-            signatureAlgorithm: this.signatureAlgorithm,
-            assertionEncryption: this.assertionEncryption,
-        };
+        return __awaiter(this, void 0, void 0, function* () {
+            const cert = yield this.getDefaultCertificate();
+            return {
+                acsUrl: this.acsUrl,
+                entityId: this.entityId,
+                response: this.responseSigned,
+                assertionSignature: this.assertionSignature,
+                signatureAlgorithm: this.signatureAlgorithm,
+                publicKey: cert.publicKey,
+                publicKeyString: saml20_1.default.stripCertHeaderAndFooter(cert.publicKey),
+            };
+        });
     }
     toMarkdown() {
         return markdownTemplate
@@ -41,8 +56,7 @@ class SPSAMLConfig {
             .replace('{{entityId}}', this.entityId)
             .replace('{{responseSigned}}', this.responseSigned)
             .replace('{{assertionSignature}}', this.assertionSignature)
-            .replace('{{signatureAlgorithm}}', this.signatureAlgorithm)
-            .replace('{{assertionEncryption}}', this.assertionEncryption);
+            .replace('{{signatureAlgorithm}}', this.signatureAlgorithm);
     }
     toHTML() {
         return marked_1.marked.parse(this.toMarkdown());
@@ -70,5 +84,5 @@ Your Identity Provider (IdP) will ask for the following information while config
 {{signatureAlgorithm}}
 
 **Assertion Encryption** <br />
-{{assertionEncryption}}
+If you want to encrypt the assertion, you can download our [public certificate](/.well-known/saml.cer). Otherwise select the 'Unencrypted' option.
 `;

package/dist/controller/utils.js

@@ -128,12 +128,13 @@ const validateSSOConnection = (body, strategy) => {
     const oidcDiscoveryUrl = 'oidcDiscoveryUrl' in body ? body.oidcDiscoveryUrl : undefined;
     const oidcClientId = 'oidcClientId' in body ? body.oidcClientId : undefined;
     const oidcClientSecret = 'oidcClientSecret' in body ? body.oidcClientSecret : undefined;
+    const metadataUrl = 'metadataUrl' in body ? body.metadataUrl : undefined;
     if (strategy !== 'saml' && strategy !== 'oidc') {
         throw new error_1.JacksonError(`Strategy: ${strategy} not supported`, 400);
     }
     if (strategy === 'saml') {
-        if (!rawMetadata && !encodedRawMetadata) {
-            throw new error_1.JacksonError('Please provide rawMetadata or encodedRawMetadata', 400);
+        if (!rawMetadata && !encodedRawMetadata && !metadataUrl) {
+            throw new error_1.JacksonError('Please provide rawMetadata or encodedRawMetadata or metadataUrl', 400);
         }
     }
     if (strategy === 'oidc') {

package/dist/db/db.js

@@ -47,6 +47,9 @@ const JacksonTTL_1 = require("./sql/entity/JacksonTTL");
 const JacksonStore_2 = require("./planetscale/entity/JacksonStore");
 const JacksonIndex_2 = require("./planetscale/entity/JacksonIndex");
 const JacksonTTL_2 = require("./planetscale/entity/JacksonTTL");
+const JacksonStore_3 = require("./sql/mssql/entity/JacksonStore");
+const JacksonIndex_3 = require("./sql/mssql/entity/JacksonIndex");
+const JacksonTTL_3 = require("./sql/mssql/entity/JacksonTTL");
 const decrypt = (res, encryptionKey) => {
     if (res.iv && res.tag) {
         return JSON.parse(encrypter.decrypt(res.value, res.iv, res.tag, encryptionKey));
@@ -113,11 +116,20 @@ exports.default = {
             case 'redis':
                 return new DB(yield redis_1.default.new(options), encryptionKey);
             case 'sql':
-                return new DB(yield sql_1.default.new(options, {
-                    JacksonStore: JacksonStore_1.JacksonStore,
-                    JacksonIndex: JacksonIndex_1.JacksonIndex,
-                    JacksonTTL: JacksonTTL_1.JacksonTTL,
-                }), encryptionKey);
+                switch (options.type) {
+                    case 'mssql':
+                        return new DB(yield sql_1.default.new(options, {
+                            JacksonStore: JacksonStore_3.JacksonStore,
+                            JacksonIndex: JacksonIndex_3.JacksonIndex,
+                            JacksonTTL: JacksonTTL_3.JacksonTTL,
+                        }), encryptionKey);
+                    default:
+                        return new DB(yield sql_1.default.new(options, {
+                            JacksonStore: JacksonStore_1.JacksonStore,
+                            JacksonIndex: JacksonIndex_1.JacksonIndex,
+                            JacksonTTL: JacksonTTL_1.JacksonTTL,
+                        }), encryptionKey);
+                }
             case 'planetscale':
                 return new DB(yield sql_1.default.new(options, {
                     JacksonStore: JacksonStore_2.JacksonStore,

package/dist/db/redis.js

@@ -54,7 +54,7 @@ class Redis {
                 };
             }
             this.client = redis.createClient(opts);
-            this.client.on('error', (err) => console.log('Redis Client Error', err));
+            this.client.on('error', (err) => console.info('Redis Client Error', err));
             yield this.client.connect();
             return this;
         });
@@ -69,7 +69,7 @@ class Redis {
         });
     }
     getAll(namespace, pageOffset, pageLimit) {
-        var e_1, _a;
+        var _a, e_1, _b, _c;
         return __awaiter(this, void 0, void 0, function* () {
             const offsetAndLimitValueCheck = !dbutils.isNumeric(pageOffset) && !dbutils.isNumeric(pageLimit);
             let take = Number(offsetAndLimitValueCheck ? this.options.pageLimit : pageLimit);
@@ -79,21 +79,28 @@ class Redis {
             let count = 0;
             take += skip;
             try {
-                for (var _b = __asyncValues(this.client.zScanIterator(dbutils.keyFromParts(dbutils.createdAtPrefix, namespace), Math.min(take, 1000))), _c; _c = yield _b.next(), !_c.done;) {
-                    const { score, value } = _c.value;
-                    if (count >= take) {
-                        break;
+                for (var _d = true, _e = __asyncValues(this.client.zScanIterator(dbutils.keyFromParts(dbutils.createdAtPrefix, namespace), Math.min(take, 1000))), _f; _f = yield _e.next(), _a = _f.done, !_a;) {
+                    _c = _f.value;
+                    _d = false;
+                    try {
+                        const { score, value } = _c;
+                        if (count >= take) {
+                            break;
+                        }
+                        if (count >= skip) {
+                            keyArray.push(dbutils.keyFromParts(namespace, value));
+                        }
+                        count++;
                     }
-                    if (count >= skip) {
-                        keyArray.push(dbutils.keyFromParts(namespace, value));
+                    finally {
+                        _d = true;
                     }
-                    count++;
                 }
             }
             catch (e_1_1) { e_1 = { error: e_1_1 }; }
             finally {
                 try {
-                    if (_c && !_c.done && (_a = _b.return)) yield _a.call(_b);
+                    if (!_d && !_a && (_b = _e.return)) yield _b.call(_e);
                 }
                 finally { if (e_1) throw e_1.error; }
             }

package/dist/db/sql/mssql/entity/JacksonIndex.d.ts

@@ -0,0 +1,7 @@
+import { JacksonStore } from './JacksonStore';
+export declare class JacksonIndex {
+    id: number;
+    key: string;
+    storeKey: string;
+    store?: JacksonStore;
+}

package/dist/db/sql/mssql/entity/JacksonIndex.js

@@ -0,0 +1,41 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JacksonIndex = void 0;
+const JacksonStore_1 = require("./JacksonStore");
+const typeorm_1 = require("typeorm");
+let JacksonIndex = class JacksonIndex {
+};
+__decorate([
+    (0, typeorm_1.PrimaryGeneratedColumn)()
+], JacksonIndex.prototype, "id", void 0);
+__decorate([
+    (0, typeorm_1.Index)('_jackson_index_key'),
+    (0, typeorm_1.Column)({
+        type: 'varchar',
+        length: 1500,
+    })
+], JacksonIndex.prototype, "key", void 0);
+__decorate([
+    (0, typeorm_1.Column)({
+        type: 'varchar',
+        length: 1500,
+    })
+], JacksonIndex.prototype, "storeKey", void 0);
+__decorate([
+    (0, typeorm_1.ManyToOne)(() => JacksonStore_1.JacksonStore, undefined, {
+        //inverseSide: 'in',
+        eager: true,
+        onDelete: 'CASCADE',
+    })
+], JacksonIndex.prototype, "store", void 0);
+JacksonIndex = __decorate([
+    (0, typeorm_1.Index)('_jackson_index_key_store', ['key', 'storeKey']),
+    (0, typeorm_1.Entity)()
+], JacksonIndex);
+exports.JacksonIndex = JacksonIndex;

package/dist/db/sql/mssql/entity/JacksonStore.d.ts

@@ -0,0 +1,8 @@
+export declare class JacksonStore {
+    key: string;
+    value: string;
+    iv?: string;
+    tag?: string;
+    createdAt?: Date;
+    modifiedAt?: string;
+}